Over 3 million WordPress sites are at risk of being compromised by a high-severity vulnerability in the All-in-One WP Migration and Backup plugin. The flaw, tracked as CVE-2026-19949, allows attackers to execute malicious code on affected websites, potentially leading to complete site takeover.
The issue lies in the way the plugin handles user-supplied input during archive restore operations. Specifically, the plugin fails to properly escape and prepare SQL queries, making it possible for an attacker to inject malicious content via WordPress’s trackback functionality. This can result in the secret key used during the restore operation being exposed, allowing the attacker to import a crafted .wpress archive containing a malicious must-use plugin.
Once deployed, this plugin can be executed upon the next page load, granting the attacker remote code execution (RCE) capabilities. Defiant, the WordPress security firm that discovered the vulnerability, warns that “as with all RCE vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques.”
The plugin’s developers have released a patch in version 7.110, which was made available on August 20. However, according to WordPress data, only 35% of all installations have been updated to the patched version, leaving approximately 3.2 million sites vulnerable.
All-in-One WP Migration and Backup is a highly popular backup and restore tool for WordPress, with over 5 million active deployments. Its widespread use makes it a prime target for attackers seeking to exploit vulnerabilities in widely-used plugins. The fact that such a large number of installations remain unpatched highlights the ongoing challenge of keeping WordPress sites secure.
The vulnerability affects all versions of the plugin up to 7.109, and users are strongly advised to update to version 7.110 as soon as possible. In addition to updating the plugin, site administrators should also be on the lookout for any suspicious activity, such as unusual traffic or login attempts, which could indicate that an attacker has compromised their site.
By taking these precautions, WordPress site owners can significantly reduce the risk of falling victim to this vulnerability and protect their online presence from potential attacks.
Source: SecurityWeek — 2026-09-03